Compliance penetration testing guides, page 2
What SOC 2, PCI DSS, HIPAA, ISO 27001, NYDFS 500 and CMMC expect from testing, with checklists, costs and the evidence auditors ask for.
ISO 27001 vs SOC 2: Which One Your Buyers Want
ISO 27001 vs SOC 2 compared: what each proves, who asks for which, how they overlap, and how one penetration test can evidence both frameworks at once.
PCI Compliance Levels and SAQ Types: Which One Applies, and When You Need a Pentest
PCI compliance levels by card brand, what each level submits, the SAQ types and who qualifies, and which SAQs require ASV scans or a penetration test.
ASV Scan vs Penetration Test: What PCI DSS Requires From Each
ASV scan vs penetration test under PCI DSS: what an Approved Scanning Vendor scan is, what Requirement 11.4 testing is, why both are required, what each finds.
Data Breach Fines and Penalties by Law: NYDFS, HIPAA, PCI DSS, GDPR, SEC and New York SHIELD
Data breach fines and penalties under NYDFS Part 500, HIPAA, PCI DSS, GDPR, the SEC rule and New York's SHIELD Act, with the enforcement actions behind them.
NIST Penetration Testing Requirements: 800-53 CA-8, CSF 2.0, 800-171, 800-115 and CIS Controls Compared
What NIST requires for penetration testing: SP 800-53 control CA-8, CSF 2.0, SP 800-171 and CMMC, the SP 800-115 method, and how CIS Control 18 compares.
PCI DSS Penetration Testing Requirements: Requirement 11.4 Explained Line by Line
PCI DSS v4.0.1 Requirement 11.4 explained: internal and external tests, segmentation testing, retesting, methodology, tester qualifications, QSA evidence.
Best SOC 2 Penetration Testing Providers in 2026: What Auditors Accept
The best SOC 2 penetration testing providers in 2026, how the Vanta and Drata partner directories work, what auditors need, and fixed prices with the retest.
Cyber Essentials Checklist: The Five Controls, Explained for US Companies
A Cyber Essentials checklist covering the five controls, scope, the Plus audit, the question set, and what a US company needs to certify for UK contracts.
NIST SP 800-171 Penetration Testing: Which Practices a Pentest Evidences
NIST SP 800-171 never names a penetration test, yet a pentest evidences a dozen of its practices. Which ones, and how results feed your SSP and SPRS score.
SOC 2 Penetration Testing Evidence Checklist: What to Hand Your Auditor
The evidence a SOC 2 auditor expects from your penetration test: scope, report, remediation, retest, attestation letter, and the criteria each item maps to.
Which Compliance Frameworks Require Penetration Testing?
A framework-by-framework guide to penetration testing for compliance: what SOC 2, PCI DSS, ISO 27001, HIPAA, GDPR, NYDFS and CMMC require, and how often.
SOC 2 Penetration Testing Requirements: Is a Pentest Required?
Does SOC 2 require a penetration test? What auditors expect, when to test for Type I vs Type II, and what a SOC 2 pentest costs.
PCI DSS Compliance Checklist
A PCI DSS v4.0.1 compliance checklist: all 12 requirements, CDE scoping, the controls mandatory since March 2025, and the testing Requirement 11 demands.
IT Security Audit: What It Is and How It Works
What an IT security audit is, what it covers, how it differs from a penetration test, and how audit services support SOC 2, ISO 27001, and HIPAA.
NYDFS Cybersecurity Regulation (23 NYCRR 500): Complete Guide
The NYDFS cybersecurity regulation (23 NYCRR 500) section by section: who it covers, Class A rules, the 500.5 testing mandate, and the April 15 certification.
Page 2 of 2 · 39 articles
Not looking for an article? See our penetration testing services, compare penetration testing providers, check the US penetration testing price index, or download the free templates and checklists.
